Back out half of the residual style fix for bug 4959, since treating <span> like residual style breaks fast/block/float/031.html (despite buildbot and people on the outside not seeing it... how weird is that).

Event coordinates cannot be calculated until there is a target.
This patch restructures the code so that the coordinates are
initialized when the mouse event is created but are not calculated
until the target is set.

There were two issues here:
(1) dragging over a non-editable webview (such as a typical Safari page) should not have
auto-scrolled at all; the fact that it did was an uninentional side effect of making
auto-scroll work for editable webviews a la Blot.
(2) the speed & hot area of the auto-scroll changed between 10.4.1 and 10.4.2.

I have a fix for (1), which is the much more important issue. I'll modify the bugzilla bug
to be about the remaining issue.

* WebView.subproj/WebView.m:
(-[WebView _autoscrollForDraggingInfo:timeDelta:]):
do nothing if not editable
(-[WebView _shouldAutoscrollForDraggingInfo:]):
return NO if not editable

* bindings/c/c_utility.cpp:
(KJS::Bindings::convertUTF8ToUTF16):
Fixed an invalid assertion that UTF8Chars is not NULL. It is valid for it to be NULL as long as
UTF8Length is 0.
This fixes an assertion failure on TOT at <http://www.musicindiaonline.com/p/x/tJO0OOBME9.As1NMvHdW/>,
where JavaScript is getting a NULL string back from some call on the Real Player plugin.

* khtml/xml/ContainerNodeImpl.cpp:
(WebCore::ContainerNodeImpl::getUpperLeftCorner): Traverse up the parent node chain
until you find one that has a sibling.
* manual-tests/linkjump-1.html: Added a note here - the bug for this test case is
still broken in TOT.
* manual-tests/linkjump-2.html: Added. Renamed scrollToAnchor.html, to group it with the
rest of the link jumping tests.
* manual-tests/linkjump-3.html: Added. Test case for this bug, <rdar://problem/4426668>.
* manual-tests/linkjump-4.html: Added. Test case for past fix, <rdar://problem/4247537>.
* manual-tests/linkjump-5.html: Added. Test case for past fix, <rdar://problem/4256060>.
* manual-tests/scrollToAnchor.html: Removed.

* page/FramePrivate.h: Changed m_redirectionTimer from a QTimer to a Timer.

* bridge/mac/MacFrame.mm:
(WebCore::MacFrame::startRedirectionTimer): Added. Avoids the need for the QTimer
"monitor" feature that I had added a while back to implement the client-redirected
callback.
(WebCore::MacFrame::stopRedirectionTimer): Ditto.

* kwq/KWQSlot.cpp: Removed slotRedirected.

* ForwardingHeaders/ksvg2/KSVGPart.h: Removed using to put Frame into various
namespaces (all of which are WebCore now anyway).

If we ever get a reproducible case of 4135845, I'll add a test for it.

This is a re-working of Maciej's fix for 3157014 (circa 2003!). Since
you can't reliably predict what the state of the page will be when
a timer fires, I've made the timer responsbile for making sure that
everything is OK to execute.

I tested @ http://www.javascriptkit.com/script/cut3.shtml with various
combinations of reload, back, and regular navigations with JS enabled/
disabled to ensure that the previous crash didn't return. I also ran a
leaks test and discovered some, but none unique to this patch. (See
<rdar://problem/4427420> TOT REGRESSION: Leaks seen on page with
JavaScript timer.)

* khtml/ecma/kjs_window.cpp:
(KJS::ScheduledAction::execute): Return early if there's no window
object. (This happens when JavaScript is disabled.)
(KJS::Window::retrieveWindow): Reversed a backwards ASSERT, increased
prettiness. (The assert fired while I was testing. Not sure why we
haven't seen it before.)
* page/Frame.cpp:
(Frame::didOpenURL): Returned setting of JavaScript enabled/disabled
preference to its rightful place. This introduces a new behavior: now,
the unload event does not fire after you've disabled JavaScript. That
seems like a good thing. (See <rdar://problem/4426506> Disabling
JavaScript should immediately end JavaScript execution.)
(Frame::begin): Ditto.

Add -Wno-deprecated-declarations to the compile flags for WebNetscapePluginPackage.m.
<rdar://problem/4427068> LMGetCurApRefNum, CloseConnection and GetDiskFragment now deprecated.
When we workaround these we can remove this compile flag.

After init() has been called on a frame, but before begin() has been
called, the frame can have JavaScript enabled when its parent doesn't.
(That seems wrong, so I've filed <rdar://problem/4426499> Child frame
momentarily has JavaScript enabled even though parent frame doesn't.)

* fast/box-sizing/percentage-height-expected.txt: A bunch of strange empty
clip rects are now dumping as (0,0) 0x0.

WebCore:

Reviewed by Eric.

- cleanup of Int/Float-Size/Point/Rect classes

I did this as part of a redo of QMatrix, but I decided I should
land this part separately.

Eliminated the concept of a null rect or point, which used to be
indicated by negative width and height.

Changed right and bottom to to be, e.g., 2 for a rect at (0,0) 2x2.
The old code followed Qt's system that says right is 1 in those cases,
which is inappropriate for floating point, and old fashioned because
modern graphics systems use coordinates for lines between pixels, not
the pixels themselves.

Other API improvements to the point, size, and rect classes. For example,
functions named with verbs now always modify the object itself.

* rendering/render_theme_mac.mm: (RenderThemeMac::paintButton): Fixed
a bug where it said x() where it should say y().

* rendering/render_image.h:
(WebCore::RenderImage::image): Return a null image when m_cachedImage is 0.
(WebCore::RenderImage::errorOccurred): Return false when m_cachedImage is 0.
* rendering/render_image.cpp: (WebCore::RenderImage::nullImage): Added.
Returns a global null image for use when we have no cached image.

* rendering/render_object.h: Renamed the old setImage to imageChanged, the
new name for the same function.
* rendering/render_object.cpp: (WebCore::RenderObject::imageChanged): Ditto.
* rendering/render_list.cpp: (RenderListMarker::imageChanged): Changed the
call to parent to call the new imageChanged instead of the old setImage.

* khtml/ecma/kjs_window.cpp: (KJS::WindowFunc::callAsFunction):
Fix check for special frame names. These special frame names are supposed
to always be unaffected by pop-up blocking. But the code instead was
saying that the special frame names are always blocked. Oops!

Fix two problems with editing around empty list items:
1) Arrowing up or down to an empty list item skipped the list item
2) Deleting the content of a list item made it so you could never get the cursor inside the empty item

Clean up the Image class. Eliminate the MIME type memebr variable.
Eliminate an unused constructor. Fix the constructor to take
a QString rather than an NSString so that it's portable. Rename
the receivedData method to decode. Move canRenderImageType into
the Image class as a static method.

- GC after destroying the very last frame to avoid node leak false positives
http://bugzilla.opendarwin.org/show_bug.cgi?id=6884

* ForwardingHeaders/JSLock.h: added
* page/Page.cpp:
(Page::~Page): In debug mode, when destroying the last page,
0 out m_mainFrame to destroy the very last frame and then garbage collect,
so a GC happens at a time when the stack won't have references into the JS
heap for the conservative GC to catch.

* page/FrameView.cpp:
(FrameView::viewportMouseMoveEvent): Moved code to set prevMouseX/Y out of here
and into dispatchMouseEvent, because it now handles mouseout and mouseover events,
and that's what these globals are used for. This fixes DumpRenderTree to work
properly with mouseout and mouseover (because it delivers only mouse down and up,
no mouse move events).
(FrameView::dispatchMouseEvent): Passed in the "other" node as the related target
for mouseout and mouseover events. Also set prevMouseX/Y.